The Ultimate Guide to Surveillance Audits for API Spec Q1 & Q2 Certification

• • Corrective actions from previous audits that remain incomplete or ineffective a common issue explained in our guide on why API Q1 certification fails in Year 2 instead of Year 1
  • Weak internal audit programs that fail to identify meaningful issues.
  • Outdated procedures that no longer reflect current practices and changes in applicable standards.
  • Incomplete or inconsistent records across departments.
  • Poor supplier evaluation and monitoring.
  • Gaps in competency and training records.
  • Inadequate risk assessments following organizational or operational changes.
  • Weak traceability of products, materials, or service activities.
  • Lack of QMS induction to new employees

Identifying and addressing these issues early helps organizations maintain compliance and reduces the likelihood of major nonconformities during an API Q1 Q2 surveillance audit.

How to Prepare for an API Surveillance Audit: Step-by-step guide

Preparing for an API Spec Q1 or Q2 surveillance audit isn’t about last-minute paperwork — it’s about proving that your QMS runs the same way whether an auditor is watching or not. Use this checklist as a working framework throughout the year, not just in the weeks before your audit date.

Close out prior nonconformities early

Don’t wait until the week before the audit to address findings from your last surveillance or certification audit. Auditors specifically check whether corrective actions were resolved promptly and effectively, with genuine root cause analysis — not just a quick documentation fix. Organizations that close out nonconformities within 30–60 days of the previous audit consistently perform better on subsequent surveillance visits, since it demonstrates a functioning corrective action process rather than reactive compliance.

Run a mock internal audit

Before the official surveillance audit, conduct an internal audit focused specifically on the clauses most likely to be sampled during this cycle. Since surveillance audits rotate coverage across API Q1/Q2 clauses over the 3-year cycle, reviewing your audit history and certification body’s sampling plan can help you predict which processes — design control, purchasing, production, or risk management — are due for scrutiny. A well-run mock audit surfaces gaps while there’s still time to fix them.

Review your management review minutes

Ensure QMS performance data, risk assessments, and quality objectives are being genuinely discussed in management review meetings — not just documented as a formality. Auditors look for evidence that leadership is actively engaged with the QMS, using metrics like nonconformity trends, customer complaints, and audit results to drive real decisions and continuous improvement, not simply signing off on a template.

Audit your own document control

Confirm that the latest approved procedure revisions are in use at the point of work — on the shop floor, in the field, and at every workstation — not just archived correctly in your document management system. A common surveillance audit finding is outdazted by procedures still being followed in practice while a newer revision sits unused in the system. Spot-check multiple departments and shifts to catch this before the auditor does.

Check customer complaint logs

Review your complaint records for completeness, timeliness, and evidence of thorough root cause analysis and corrective action. Surveillance auditors treat customer complaints as a real-world signal of how well your QMS is actually functioning, so incomplete or superficially resolved complaints are a red flag that can trigger deeper questioning into related processes.

Verify Monogram/mark usage

If your organization holds an API Monogram license, confirm the mark is being applied correctly and exclusively to conforming products, packaging, nameplates, and certificates of conformance. Misuse or inconsistent application of the Monogram is one of the fastest ways to draw a major nonconformity, since it directly affects the integrity of the certification mark in the marketplace.

Brief key personnel

Make sure staff across departments — not just the quality manager — can confidently and accurately describe their own processes to an auditor. Surveillance auditors frequently interview production, engineering, and field personnel directly, and inconsistent answers between what’s documented and what employees actually do is one of the most common sources of findings. A short pre-audit briefing on expected questions and process ownership goes a long way.

Review any organizational changes

Any changes to your certified scope, facilities, key personnel, subcontractors, or processes since the last audit need to be reflected in your quality manual and scope statement before the auditor arrives. Unreported organizational changes can create scope discrepancies that auditors are specifically trained to flag, potentially triggering additional audit time or follow-up requirements.

What Happens if Nonconformities Are Found During a Surveillance Audit?

If nonconformities are identified during the surveillance audit, the organization is expected to take timely corrective action.

The typical process includes:

1. The auditor documents the nonconformity and explains the applicable requirement.
2. The organization performs a root cause analysis to determine why the issue occurred.
3. A corrective action plan is submitted within the timeframe specified by the certification body.
4. Evidence of implementation may be reviewed before the finding is closed.

If a nonconformity from a previous surveillance audit is repeated, it indicates that the earlier corrective action was ineffective or not fully implemented. In such cases, auditors will assess the effectiveness of the organization’s root cause analysis, evaluate whether the issue is systemic, and may raise a more serious nonconformity.

Failure to address major nonconformities—or repeated recurrence of the same issues—may result in suspension of certification. Persistent or unresolved nonconformities can ultimately lead to the withdrawal of certification

Best Practices for Staying Audit Ready

Successful organizations treat surveillance audits as part of their continual improvement process rather than an annual event.

Recommended practices include: